Contents
What are different logon types?
In this article
| Logon type | # | Authenticators accepted |
|---|---|---|
| Interactive (also known as, Logon locally) | 2 | Password, Smartcard, other |
| Network | 3 | Password, NT Hash, Kerberos ticket |
| Batch | 4 | Password (stored as LSA secret) |
| Service | 5 | Password (stored as LSA secret) |
What is 0xc0000064?
The error code 0xc0000064 means that the specified user does not exist. I know you said that you do have a user named ‘randy’ in your domain. So to fix it, you have a look at the applications on the workstation HPDB1, and find out which one is trying to log in as ‘randy’ but not adding in your domain prefix.
What is Windows event4624?
Event ID 4624 (viewed in Windows Event Viewer) documents every successful attempt at logging on to a local computer. This event is generated on the computer that was accessed, in other words, where the logon session was created. A related event, Event ID 4625 documents failed logon attempts.
What is CredPro?
CredPro indicates a logon initiated by User Account Control. With these, you can determine that someone is in fact trying to log on. At regular intervals, could be a script (maybe, at that lenght they are trying to make it seem like it’s another admin or something, compared to trying to log on every 30 minutes).
What is a Type 2 login?
Logon Type 2: Interactive. An event with logon type=2 occurs whenever a user logs on (or attempts to log on) a computer locally, e.g. by typing user name and password on Windows logon prompt. Events with logon type = 2 occur when a user logs on with a local or a domain account.
What is logon type 10?
What does logon type 10 mean? Logon type 10 refers to remote interactive logons. Event ID 528 with logon type 10 means that the user logged on to the computer through RDP by using either Remote Desktop or Windows 2000 Server Terminal Services.
Why is %% 2313 failure?
%%2312. User not allowed to logon at this computer. %%2313. Unknown user name or bad password.
What is a Type 3 logon?
Logon type 3: Network. A user or computer logged on to this computer from the network. The description of this logon type clearly states that the event logged when somebody accesses a computer from the network. Commonly it appears when connecting to shared resources (shared folders, printers etc.).
What is special privileges assigned to new logon?
Special privileges were assigned to a new logon. If sensitive privileges are assigned to a new logon session, event 4672 is generated for that particular new logon. This event is generally recorded multiple times in the event viewer as every single local system account logon triggers this event.
What is logon process CredPro?
Logon Process: (see 4611) CredPro indicates a logon initiated by User Account Control. Authentication Package: (see 4610 or 4622) Package name: If this logon was authenticated via the NTLM protocol (instead of Kerberos for instance) this field tells you which version of NTLM was used.
What does logon type 8 mean on Windows Server?
From a windowsecurity.com webpage: Logon Type 8 – NetworkCleartext. This logon type indicates a network logon like logon type 3 but where the password was sent over the network in the clear text. Windows server doesn’t allow connection to shared file or printers with clear text authentication.
What is the logon type for networkcleartext?
Logon Type 8 – NetworkCleartext. This logon type indicates a network logon like logon type 3 but where the password was sent over the network in the clear text. Windows server doesn’t allow connection to shared file or printers with clear text authentication.
How to find account lockout source for logon type 8?
In this article, I am going explain how to Trace and Find Account Lockout Source and Logon Failure Reason of an AD User for Logon Type 8. The logon type 8 occurs when the password was sent over the network in the clear text. Basic authentication in IIS is most possible cause for this kind of login failure.
What does logon Type 3 on event log mean?
Logon type 3: Network. A user or computer logged on to this computer from the network. The description of this logon type clearly states that the event logged when somebody accesses a computer from the network.